Hi Rich, > Date: 2026-11-12 08:55:01-0500 > From: Rich Felker > > On Thu, Nov 12, 2026 at 02:45:16PM +0100, Vincent Lefevre wrote: > > On 2026-11-12 14:23:08 +0100, Alejandro Colomar wrote: > > > Hmm, yeah, I didn't intend to say POSIX is bad; I just wanted to let > > > people know that POSIX is irrelevant about crypt(3) these days (as Rich > > > said). Perhaps: > > > > > > The POSIX specification is significantly outdated, > > > and all systems extend it significantly. > > > > > > What do you think? > > > > OK for me. > > It's not "outdated". It just does not mandate particular algorithms > but leaves these choices up to the implementation. As usual the scope > of POSIX is what applications need to know to interface with the > system, not administrative policy. This is why POSIX doesn't define > things like mount, how init works, etc. either. They are in the scope > of things that applications generally don't have to care about; only > system components do. But is the POSIX specification really useful for applications? An application is probably not interested in knowing that it shall pass two characters as the salt from the set './[A-Za-z]'. An application should not rely on the specified return value either. > > I do think there are changes to the POSIX crypt spec that could make > it better, like defining more errors and specifying explicitly that > salts beginning with '$' and '_' select additional > implementation-defined algorithms and settings, etc. But overall the > issue here is just a difference in expectation, not anything > inherently bad. I agree it's not inherently bad. It's just that extensions have grown for a long time, and deviated between themselves for various reasons (most notably in the return value), enough that programmers must be aware of too many implementation-defined details that they should entirely ignore POSIX. Cheers, Alex > Rich > --